#!/bin/bash

export USER=$1
export SERVER=$2

export CERT_DIR=$HOME/.kube/$SERVER/users/$USER
export CA_CERT_DIR=$HOME/.kube/$SERVER

export SERVER_USER_DIR="~/.kube/users/$USER"

if [ -z $USER ]; then
echo "No arguments supplied! Format is ./adduser.sh <USER> <SERVER_FQDN>"
exit 1
fi

if [ -z $SERVER ]; then
echo "No server supplied for user $USER"
exit 1   
fi

if [ $USER=="admin" ]; then
echo "Creating admin user for server $SERVER"
fi

echo "Creating cert dir"
mkdir -p $CERT_DIR

if [ $? -ne 0 ]; then
    echo "Couldn't create cert dir at $CERT_DIR"
    exit 1
fi

echo "Generating openssl cert"
docker run -it -v $CERT_DIR:/$USER python:latest openssl genrsa -out /$USER/$USER.key 2048

if [ $USER=="admin" ]; then
docker run -it -v $CERT_DIR:/$USER python:latest openssl req -new -key /$USER/$USER.key -out /$USER/$USER.csr -subj "/CN=$USER/O=system:masters"
else
docker run -it -v $CERT_DIR:/$USER python:latest openssl req -new -key /$USER/$USER.key -out /$USER/$USER.csr -subj "/CN=$USER/O=user"
fi
# /CN=admin/O=manager

if [ $? -ne 0 ]; then
    echo "Couldn't create cert with Docker. Are you sure it's running?"
    exit 1
fi

echo "Creating namespace dir on server"
ssh $SERVER "mkdir -p $SERVER_USER_DIR"
echo "Copying client csr to server cert dir"
scp $CERT_DIR/$USER.csr $SERVER:$SERVER_USER_DIR/$USER.csr

if [ $? -ne 0 ]; then
    echo "Failed to copy client csr to server cert dir"
    exit 1
fi

echo "Getting cert signing pod"
export CERT_POD=$(ssh $SERVER "kubectl get pod -n kube-system --selector=app=certsigner --output=jsonpath={.items..metadata.name}")

if [ -z $CERT_POD ]; then
    echo "Installing certsigner"
    helm template certsigner ./certsigner | ssh $SERVER "sudo -E kubectl apply -f -"
fi

while [ -z $CERT_POD ]; do
    echo "Getting cert signing pod"
    export CERT_POD=$(ssh $SERVER "kubectl get pod -n kube-system --selector=app=certsigner --output=jsonpath={.items..metadata.name}")
    sleep 2
done

if [ $? -ne 0 ]; then
echo "Failed to install certsigner."
fi

echo "Signing cert with pod $CERT_POD"
ssh $SERVER "kubectl -n kube-system cp $SERVER_USER_DIR/$USER.csr $CERT_POD:/certs/$USER.csr"
ssh $SERVER "kubectl -n kube-system exec $CERT_POD -- openssl x509 -in /certs/$USER.csr -req -CA /keys/client-ca.crt -CAkey /keys/client-ca.key -set_serial $(python -c 'import random; print(random.randint(1000000000, 9999999999))') -out /certs/$USER.crt -days 5000"
ssh $SERVER "kubectl -n kube-system cp $CERT_POD:/certs/$USER.crt ~/.kube/users/$USER/$USER.crt"
echo "retrieving signed cert"
scp $SERVER:$SERVER_USER_DIR/$USER.crt $CERT_DIR/$USER.crt

echo "retrieving server ca"
wget --no-check-certificate https://$SERVER:6443/cacerts -O $CA_CERT_DIR/server-ca.pem
echo "adding server to config with new context $SERVER-$USER"
kubectl config set-cluster $SERVER --server=https://$SERVER:6443 --certificate-authority=$CA_CERT_DIR/server-ca.pem
kubectl config set-credentials $USER-$SERVER --client-certificate=$CERT_DIR/$USER.crt --client-key=$CERT_DIR/$USER.key

if [ $USER=="admin" ]; then
kubectl config set-context $SERVER-$USER --cluster=$SERVER --namespace=kube-system --user=$USER-$SERVER
else
kubectl config set-context $SERVER-$USER --cluster=$SERVER --namespace=$USER --user=$USER-$SERVER
fi

kubectl config set current-context $SERVER-$USER

if [ $USER=="admin" ]; then
echo "Admin user created, skipping namespace"
exit 0
fi

echo "Templating namespace with helm and copying to server"
helm template $USER --set user=$USER ./namespace | ssh $SERVER "cat - > $SERVER_USER_DIR/namespace.yaml"

if [ $? -ne 0 ]; then
    echo "Failed to template namespace. Is helm installed?"
    exit 1
fi

echo "Creating namespace from template"
ssh $SERVER "kubectl apply -f $SERVER_USER_DIR/namespace.yaml"

if [ $? -ne 0 ]; then
    echo "Failed to create namespace"
    exit 1
fi